aedat (>=1.2.3, <=1.3.3), aerovault (>=0.6.0, <=0.6.5) +1003 more potentially affected by unknown CVE via zstd-safe (>=4.1.0+zstd.1.5.0, <=7.3.0)

zstd-safe CARGO version =4.1.0+zstd.1.5.0, =1.2.3, =0.6.0, =0.1.0-alpha, =0.1.2, =0.4.0, =0.45.0, =0.0.6, =0.0.6, =0.1.0, =0.1.25, =0.1.12, =0.3.0, =0.3.1 - ambientprofiling 1.0.9 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0397...

aerovault (>=0.6.0, <=0.6.5), aetheric-core (>=0.1.0-alpha, <=0.1.2-alpha) +508 more potentially affected by unknown CVE via zstd (0.13.3)

zstd CARGO version 0.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on zstd and may be impacted: - aerovault =0.6.0, =0.1.0-alpha, =0.1.2, =0.45.0, =0.0.6, =0.0.6, =0.1.0, =0.1.36, =0.1.25, =0.3.0, =0.1.0, =0.1.0, =0.6.1 - antecedent-io 2.0.0 and mo...

RUSTSEC-2026-0401 Out-of-bounds read in `train_from_buffer` when sample sizes overflow

ZDICTtrainFromBuffer is never told the length of the samples buffer, so trainfrombuffer checked that the sample sizes add up to it. With overflow checks off, as in release builds, that sum wrapped around: sizes totalling 2^64 plus the buffer length passed the check, and the trainer read past the...

RUSTSEC-2026-0398 `Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end

ZSTDseekabledecompress shortens the requested length to the end of the data without checking that the offset is before it. For an offset past the end, it returns a wrapped-around length without writing anything, and Seekable::decompress passed that length to Vec::setlen. With the seekable feature...

aedat (1.3.3), aerovault (>=0.6.0, <=0.6.5) +931 more potentially affected by unknown CVE via zstd-safe (>=4.1.4+zstd.1.5.2, <=7.3.0)

zstd-safe CARGO version =4.1.4+zstd.1.5.2, =0.6.0, =0.1.0-alpha, =0.1.2, =0.4.0, =0.45.0, =0.0.6, =0.0.6, =0.1.0, =0.1.32, =0.1.20, =0.3.0, =0.1.0, =0.5.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0404...

RUSTSEC-2026-0393 Out-of-bounds read when training a dictionary from inconsistent sample sizes

ZDICTtrainFromBuffer is never told the length of the samples buffer. Before 0.4.10, zstd::dict::fromcontinuous initially traindict called it directly: up to 0.2.1 without checking the sample sizes against the buffer at all, and from 0.3.0 with a sum that wraps around when overflow checks are off,...

RUSTSEC-2026-0406 Use-after-free when changing a multithreaded context with an unfinished frame

When a multithreaded frame zstdmt feature, CParameter::NbWorkers is left unfinished, its jobs may still be running on the worker threads: the C library only waits for them when the next frame starts, or when the context is freed. A session reset makes the context accept changes again in the...

Use-after-free with `CParameter::StableInBuffer`

With CParameter::StableInBuffertrue experimental feature, the C library keeps a pointer to the input of one streaming call and reads from it in later calls, including flushstream and endstream, which take no input. An InBuffer only borrows its slice for one call, so safe code could free it in...

Out-of-bounds read when training a dictionary from inconsistent sample sizes

ZDICTtrainFromBuffer is never told the length of the samples buffer. Before 0.4.10, zstd::dict::fromcontinuous initially traindict called it directly: up to 0.2.1 without checking the sample sizes against the buffer at all, and from 0.3.0 with a sum that wraps around when overflow checks are off,...

Use-after-free when changing a multithreaded context with an unfinished frame

When a multithreaded frame zstdmt feature, CParameter::NbWorkers is left unfinished, its jobs may still be running on the worker threads: the C library only waits for them when the next frame starts, or when the context is freed. A session reset makes the context accept changes again in the...

Uninitialized memory exposed by `write::Decoder` on a corrupt legacy frame

From 0.4.22 to 0.7.x, the writer behind zstd::stream::write::Decoder set its output buffer's length to its full capacity before each decompression call, then to the position the call reported, and only checked for an error afterwards. When decompression fails inside a legacy zstd v0.4 to v0.7...

WebAssembly allocator shim corrupts memory on allocation failure

On wasm32, zstd-sys provides malloc and free to the C library through a shim over Rust's allocator. The shim did not check for allocation failure: it wrote its size header to address 0 and returned address 4, which the C library used as a valid buffer. freeNULL also read below address 0. Whenever...

Uninitialized memory exposed when streaming decompression of a legacy frame fails

When decompression fails inside a legacy zstd v0.4 to v0.7 frame, the bundled zstd library reports the output buffer as fully written although nothing was written. DCtx::decompressstream committed that position even on error, and for a Vec destination this extended the vector's length over...

Use-after-free through `init_using_cdict` and `init_using_ddict`

CCtx::initusingcdict and DCtx::initusingddict experimental feature, deprecated took the dictionary as &CDict and &DDict with only 'b: 'a, so the dictionary itself could be dropped while the context still pointed at it. The same mistake in other constructors was fixed earlier . The flaw was...

Heap buffer overflow in `CCtx::try_clone` on a multithreaded context

CCtx::tryclone experimental feature, deprecated copies tables sized from the context's applied parameters. Starting a multithreaded frame zstdmt feature replaces those parameters with the workers' without resizing the context's own tables, so after an abandoned single-threaded frame, the copy wro...

Out-of-bounds read in `train_from_buffer` when sample sizes overflow

ZDICTtrainFromBuffer is never told the length of the samples buffer, so trainfrombuffer checked that the sample sizes add up to it. With overflow checks off, as in release builds, that sum wrapped around: sizes totalling 2^64 plus the buffer length passed the check, and the trainer read past the...

PT-2026-125058

CCtx::init using cdict and DCtx::init using ddict experimental feature, deprecated took the dictionary as &CDict and &DDict with only 'b: 'a, so the dictionary itself could be dropped while the context still pointed at it. The same mistake in other constructors was fixed earlier . The flaw was...

PT-2026-125061

CCtx::try clone experimental feature, deprecated copies tables sized from the context's applied parameters. Starting a multithreaded frame zstdmt feature replaces those parameters with the workers' without resizing the context's own tables, so after an abandoned single-threaded frame, the copy...

PT-2026-125060

ZDICT trainFromBuffer is never told the length of the samples buffer, so train from buffer checked that the sample sizes add up to it. With overflow checks off, as in release builds, that sum wrapped around: sizes totalling 2^64 plus the buffer length passed the check, and the trainer read past t...

PT-2026-125062

When decompression fails inside a legacy zstd v0.4 to v0.7 frame, the bundled zstd library reports the output buffer as fully written although nothing was written. DCtx::decompress stream committed that position even on error, and for a Vec destination this extended the vector's length over...